Skip to Content

Contact us

Leave a message and we’ll get back to you


You can also reach us at:

Cyber Security Research Center @ Ben-Gurion University of the Negev
P.O.B. 653
Beer Sheva, 84105,

+972 8 6428005
+972 8 6428121

Detection of malicious webmail attachments based on propagation patterns

Yehonatan Cohen, Danny Hendler, Amir Rubin

Knowledge-Based Systems Volume 141, 1 February 2018, Pages 67-79

Email remains one of the key media used by cybercriminals for distributing malware. Based on a large data set consisting of antivirus telemetry reports, we conduct the first comprehensive study of the properties of malicious webmail attachments. We show that they are distinct among the general web-borne malware population in terms of the malware reach (the number of machines to which the malware is downloaded), malware type and family. Furthermore, we show that malicious webmail attachments are unique in the manner in which they propagate through the network.

We leverage these findings for defining novel features of malware propagation patterns. These features are derived from a time-series representation of malware download rates and from the community structure of graphs that model the network paths through which malware propagates. Based on these features, we implement a detector that provides high-quality detection of malicious webmail attachments.

Back to top